summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2013-09-26MokManager: fetch more info from X509 nameGary Ching-Pang Lin
2013-09-26MokManager: reboot the system after clearing MOK passwordGary Ching-Pang Lin
2013-09-26MokManager: enhance the password prompt for SB stateGary Ching-Pang Lin
2013-09-26MokManager: rearrange the output of MOK infoGary Ching-Pang Lin
2013-09-26Disable floating points in b_printGary Ching-Pang Lin
The long double declaration will enable SSE and cause a compilation error. Disabling everything related to floating points avoids the error.
2013-09-26Enable openssl bio_printf()Gary Ching-Pang Lin
bio_printf() was replaced with a dummy function and this made several openssl functions useless. This commit adds the print functions back, so that we don't have to implement our own ASN1 time print function.
2013-09-26MokManager: enhance the password promptGary Ching-Pang Lin
2013-09-26MokManager: remove the duplicate get_keystroke()Gary Ching-Pang Lin
2013-09-26MokManager: draw the countdown screenGary Ching-Pang Lin
2013-09-26MokManager: Remove the unnecessary string duplicationGary Ching-Pang Lin
2013-09-26Correct the certificate count of the signature listGary Ching-Pang Lin
2013-09-26Since different distros name grub*.efi differently, make it compile-time.Peter Jones
Basically, if you don't want grub.efi, you do: make 'DEFAULT_LOADER=\\\\grubx64.efi' Signed-off-by: Peter Jones <pjones@redhat.com>
2013-09-26Define the PXE 2nd stage loader in the beginning of the fileGary Ching-Pang Lin
Make it easier to change the PXE 2nd stage loader. Conflicts: netboot.c
2013-09-26Remove double-separators from the bootpathGary Ching-Pang Lin
2013-09-26Fix the broken bootpathGary Ching-Pang Lin
- The file path from DevicePathToStr may use slash as the file seperator. Change all slashes to backslashes to avoid the strange bootpath. - Remove the redundant backslashes. - ImagePath no longer requires the leading backslash. - Fix a memory leak Based on the patch from Michal Marek <mmarek@suse.com>
2013-09-26MokManager: support Tradition DES hashGary Ching-Pang Lin
2013-09-26MokManager: support MD5-based crypt() hashGary Ching-Pang Lin
2013-09-26MokManager: support blowfish-based crypt() hashGary Ching-Pang Lin
Conflicts: Makefile
2013-09-26MokManager: support SHA512-based crypt() hashGary Ching-Pang Lin
2013-09-26MokManager: support crypt() password hashGary Ching-Pang Lin
The password format is introduced for the password hash generated by crypt(), so that the user can import the password hash from /etc/shadow. The packager, especially those who packages 3rd party drivers, can utilize this feature to import a 3rd party certificate without interfering the package installation. This commit implements the sha256-based crypt() hash function. Conflicts: Makefile MokManager.c
2013-09-26Make EFI_PATH easily resettable from the build command line.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-09-26Clean lib/, tooGary Ching-Pang Lin
2013-09-26simple_file: Allocate buffers for file entriesGary Ching-Pang Lin
The dir filter appends L'/' to the directory entries without allocating a new buffer, and this could crash the whole program.
2013-09-26Port MokManager to Linux Foundation loader UI codeMatthew Garrett
This is the first stage of porting the MokManager UI to the UI code used by the Linux Foundation UEFI loader.
2013-09-26Port MokManager to Linux Foundation loader UI codePeter Jones
This is the first stage of porting the MokManager UI to the UI code used by the Linux Foundation UEFI loader. Conflicts: MokManager.c
2013-09-26We have to declare SHIM_LOCK_GUID here as well.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com> Conflicts: MokManager.c
2013-09-26Ignore tarballs.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-09-26MokManager needs to disable the graphics console.Peter Jones
Without this patch, on some machines we never see MokManager's UI. This protocol has never (I think?) been officially published, and yet I still have new hardware that needs it. If you're looking for a reference, look at: EdkCompatibilityPkg/Foundation/Protocol/ConsoleControl/ConsoleControl.c in the edk2 tree from Tiano. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-09-24Fix a memory leakSteve Langasek
2013-09-24Correct limits on the length of ipv6 addressesSteve Langasek
The maximum length of a string representation of an ipv6 address is 39 characters (8 groups of 4 hex chars, with 7 colons in between). So don't allocate more room than this - and more importantly, don't blindly accept strings from the server that are longer than our buffer...
2013-09-24More consistent types, fewer castsSteve Langasek
2013-09-24Misc allocation cleanupsSteve Langasek
2013-09-24Fix an off-by-one errorSteve Langasek
We don't need to add one because our end pointer is already off the end of the string we want to copy.
2013-09-24Fix nul termination errors in filenames passed to tftpSteve Langasek
Fix various errors in the tftp string handling, to ensure we always have properly nul-terminated strings.
2013-09-24Build with -Werror to catch future prototype mismatches.Steve Langasek
2013-09-24Pass the right arguments to EFI_PXE_BASE_CODE_TFTP_READ_FILESteve Langasek
A wrong pointer was being passed to EFI_PXE_BASE_CODE_TFTP_READ_FILE, preventing us from getting the file size back from the tftp call, ensuring that we don't have enough information to properly secureboot-validate the retrieved image.
2013-09-23Add MokListRT option rom entry.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-09-23Update TODO with missing description.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-09-23Made TODO represent the present.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-09-23Make SHIM_LOCK_GUID a first-class object with a symbol.Peter Jones
Right now the CA is checking if shim builds expose a particular version of the shim protocol. To do this, they're looking for SHIM_LOCK_GUID's value in the resulting binary. Currently, with SHIM_LOCK_GUID as a macro that gets assigned to local variables, that means they have to compensate for mov instructions mixed in with the actual value. This is completely absurd, so promote it to a first-class object with a symbol to make it both easy to find and continuous. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-09-16Don't print things on the screen by default when everything works.Peter Jones
There's no point to this text, and it generally confuses people. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-09-16Don't print that fallback isn't found in should_use_fallback()Peter Jones
The call can simply fail if it isn't found - which will be the case on removeable install media. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-06-11Fix some pointer casting issues.Peter Jones
This also fixes the size of an empty vendor_cert or dbx_cert. Signed-off-by: Peter Jones <shim-owner@fedoraproject.org>
2013-06-10Bump version to 0.40.4Peter Jones
Since I've finally merged in the "sections" branch, best to increment the version number. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-06-10Make DBX be included in build if the environment is set right.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-06-10Make .vendor_cert get the right flags set.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-06-10add a .gitignorePeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-06-10Move embedded certificates to their own section.Peter Jones
With this change, the embedded certificate and dbx lists (vendor_cert, vendor_cert_size, vendor_dbx, and vendor_dbx_size) wind up being in a section named .vendor_cert, and so will look something like: ------ fenchurch:~/devel/github.com/shim$ objdump -h shim.efi shim.efi: file format pei-x86-64 Sections: Idx Name Size VMA LMA File off Algn 0 .eh_frame 000174a8 0000000000005000 0000000000005000 00000400 2**3 CONTENTS, ALLOC, LOAD, READONLY, DATA 1 .text 000aa7e1 000000000001d000 000000000001d000 00017a00 2**4 CONTENTS, ALLOC, LOAD, READONLY, CODE 2 .reloc 0000000a 00000000000c8000 00000000000c8000 000c2200 2**0 CONTENTS, ALLOC, LOAD, READONLY, DATA 3 .data 00031228 00000000000c9000 00000000000c9000 000c2400 2**5 CONTENTS, ALLOC, LOAD, DATA 4 .vendor_cert 00000375 00000000000fb000 00000000000fb000 000f3800 2**0 CONTENTS, READONLY 5 .dynamic 000000f0 00000000000fc000 00000000000fc000 000f3c00 2**3 CONTENTS, ALLOC, LOAD, DATA 6 .rela 0002afa8 00000000000fd000 00000000000fd000 000f3e00 2**3 CONTENTS, ALLOC, LOAD, READONLY, DATA 7 .dynsym 0000f1f8 0000000000128000 0000000000128000 0011ee00 2**3 CONTENTS, ALLOC, LOAD, READONLY, DATA ------ This simplifies a security audit, because it means that different versions of shim with substantially the same code with different keys will be more easily comperable, and therefore logic differences may be more easily identified. This also means that if there's a trusted build you want to use, you can remove the certificates, implant new ones, and have it signed, and the code sections won't change. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-06-10vendor_cert_size's size in the binary should be 4, not -4.Peter Jones
The thing about subtraction is that the minuend needs to be before the subtrahend in the text. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-06-10Remove FALLBACK_OBJS during clean as well.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-22 22:19:22 +0000